The present invention relates to a network security system or the like, and in particular, to a network security system or the like which can detect illegally connected access points.
Computers are widely used in various sites such as offices and homes. Computers generally used include desk top type PCs (Personal Computers) substantially fixed to a predetermined place such as a desk, notebook type PCs designed to be relatively small for portability, and PDAs (Personal Digital Assistants). These computers transmit and receive data to and from external equipment through the network. In particular, in recent years, data are transmitted and received by radio using wireless LAN modules. Introduction of a wireless LAN module allows a user to easily transmit and receive data to and from external equipment even when the user is out of his or her office or home, as long as the computer can transmit and receive data to and from wireless base stations (hereinafter referred to as “access points”) connected to the network.
In data transmissions to and from access points, computers not permitted to connect to the network illegally connect to the network to steal data. Thus, various processes have been executed in order to prevent such illegal connections to the network. For example, with an approach called “WEP (Wired Equivalent Privacy), data is encrypted on the basis of a 64- or 128-bit key to check for errors or alterations in order to prevent illegal connections. However, with the WEP, if the key is illegally obtained, the encrypted data is easily decrypted. On the other hand, an approach called “MAC (Media Access Control) Address Filtering” inhibits accesses by computers having MAC addresses other than those of computers permitted beforehand to access the network. However, MAC addresses can be forged relatively easily. Accordingly, it is difficult to provide a function of completely preventing illegal accesses by computers that are not permitted.
Thus, a method of incorporating a plurality of approaches has recently been employed. For example, user IDs and passwords are used to manage connections attempted by predetermined users, the MAC (Media Access Control) Address Filtering is used to manage connections attempted by predetermined computers, and an approach called “802.1x” is used to encrypt data. With the 802.1x, for each session between a computer and an access point, the above WEP key is dynamically generated and used for authentication. That is, with this method, a different key is used for each session. Accordingly, even if the key is stolen, it is invalid for the next session.
However, the above method may be invalid if an illegal access point is connected to the network. In general, the WEP key is saved to a memory of a computer or access point, and is authenticated uni-directionally by the access point. Thus, the access point authenticates a user using the computer, but it is impossible for the user to authenticate the access point. Consequently, if an access point is illegally installed, data may be illegally obtained through it or an illegal user's client may be taken over.
Further, the WEP key may be bidirectionally authenticated, i.e. the computer and the access point may authenticate each other. However, in this case, an authentication server different from a server or a client must be installed on the network. Further, much time and labor is required to set the authentication and to manage illegal accesses.
The present invention is based on the above technical problems. It is a main purpose of the present invention to provide a network security system or the like which can enhance security in a network for wireless communication.